package com.aaa.security;

import org.apache.commons.lang.StringUtils;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.stereotype.Repository;

import javax.servlet.http.HttpServletRequest;
import java.util.Collection;

@Repository("rbacConfig")
public class RbacConfig {
    public boolean hasPermission(Authentication authentication,HttpServletRequest request){

     //   System.out.println("判断是否有权限");
        //判断是否登录
        Object principal = authentication.getPrincipal();
       // System.out.println(authentication.getAuthorities());
        if("anonymousUser".equals(principal)){
          //  System.out.println("未登录");
            return false;
        }/*else{
            // 请求路径：截取最后一部分,list
            // emp/list
            String uri = request.getRequestURI();//得到请求路径
            int lastIndexOf = uri.lastIndexOf("/");//得到最后一个斜杠得位置
            String endUrl = uri.substring(lastIndexOf+1);//获取最后一个斜杠后得请求路径
            System.out.println("endUrl:"+endUrl);

            Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();//获取登录用户得权限信息
            System.out.println("authorities:"+authorities);

            Object[] array = authorities.toArray();
            boolean info=false;
            for (int i=0;i<array.length;i++) {
                if(array[i].equals("ROLE_ADMIN")){
                    info=true;
                    System.out.println("info1"+info);
                }
            }
            System.out.println("info2"+info);
            if(info!=false){
                return true;
            }else {
                return false;
            }
         *//**//*   System.out.println(array[2]);
            System.out.println(array[2].toString());
            System.out.println(array[2].toString().equals(endUrl));
            return array[2].toString().equals(endUrl);//判断用户是否有这个请求路径如果有返回true可以访问如果无返回false不能访问*//**//*
        }*/

else {
            Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();//获取登录用户得权限信息
            Object[] array = authorities.toArray();
            String uri=request.getRequestURI();
            //第一个参数 原字符 第二个 字符中出现的字符 第三个 第几次出现
            int startIndex = StringUtils.ordinalIndexOf(uri, "/", 1);//第一个 / 的位置
            int endIndex = StringUtils.ordinalIndexOf(uri, "/", 2);//第二个 / 的位置
            String permission = uri.substring(startIndex+1,endIndex);
            System.out.println(permission.toString());
            for (int i=0;i<array.length;i++){//如果请求路径包含了权限返回true
               if(array[i].toString().contains(permission)){
                   return  true;
               }else {
                   return false;
               }
            }
            return false;

        //    boolean info=false;
         /* for (int i=0;i<array.length;i++){
              if(array[i].toString().equals("{authority=ROLE_ADMIN}")||array[i].toString()==("authority=ROLE_ADMIN")){
                 return  true;
              }
          }*/
/*
            return info;
*/
        }

    }

}
